Eavesdropping in Semiquantum Key Distribution Protocol: 
Classical vs. Hadamard Bob 
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The quantum key distribution protocol with classical Bob, well known as semiquantum key dis- 
tribution, has been proposed a few years back (Boyer et al., PRL 2007, PRA 2009). In this protocol 
Alice has the same capability as in the traditional BB84 protocol, but Bob is limited by the con- 
straint that he can measure or prepare qubits only in {|0), |1)} basis and reflect any other qubit 
(or in other words, let it go undisturbed). In this scheme the qubits travel from Alice to Bob and 
then again from Bob to Alice. We study an eavesdropping strategy on this scheme that listens 
to the channel in both the directions. With the same level of disturbance induced in the channel, 
Eve can be extract more information using our two-way strategy than what can be obtained by 
the direct application of one-way eavesdropping in case of BB84 protocol. Towards resisting this 
eavesdropping strategy, we modify the semiquantum scheme by incorporating a Hadamard gate at 
Bob's end. 
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I. INTRODUCTION 

The BB84 protocol is used by Alice and Bob to settle 
on a secret classical bit-string over an insecure quantum 
channel where Eve can have access. The basic idea be- 
hind the security of the famous BB84 [l| protocol is that 
if one wants to distinguish two non-orthogonal quantum 
states, then obtaining any information is only possible 
at the expense of introducing disturbance in the state (s). 
There are a number of important papers that analyze 
this scheme and we refer to [H, @, Q and the references 
therein for further reading. The BB84 protocol [l[ uses 
the bases |0), |1) and |+) = |-) = ^Hi>. In this 

case, Bob has the capability of measuring the qubits in 
either Z, i.e., {|0), |1)} or X, i.e., basis. 

In Q, it has been considered that Bob does have lim- 
ited capability and he can do the following. 

• Whenever a qubit passes through Bob, he can let 
it go undisturbed, or in other words he can reflect 
the qubit to Alice (CTRL bits). 

• Otherwise 

— he can measure the qubit in the Z basis and 

— prepare a fresh qubit in the same basis and 
send it to Alice (SIFT bits). 

Based on this limited capability of Bob, semiquantum 
key distribution has been presented in [J] and later it 
has been analyzed in more detail in The authors 
call the Z basis as the classical basis, as it has one-to- 
one correspondence with the classical bits. Bob is called 



classical since he prepares and measures qubits in this 
basis only. Alice is not classical, as she needs to deal 
with quantum superposition of the computational basis 
states. Thus the protocol is called semiquantum. We give 
a brief description of the protocol [|[ in Table fl] 

In the authors proved that the protocol is robust. 

This is in the sense that for any attack inducing no error 
on TEST and CTRL bits, Eve's final state is independent 
of the qubits chosen by Bob as SIFT and the states sent 
by Alice. However, they did not give any quantitative 
estimate connecting the disturbance experienced by Alice 
and the information leakage at Eve's end. In [H, Section 
I], the authors made the following comment: 

Note that our result does not imply that Eve 
cannot gain a large amount of information by in- 
ducing a very small but nonzero noise on qubits. 
It is however our belief that such a discontinu- 
ity of "information versus disturbance" does not 
occur, but the question is beyond the scope of 
this paper and is left for future research. 

This gives us motivation to investigate the exact relation- 
ship between the disturbance and information leakage 
under certain eavesdropping model. In the semiquantum 
protocol [H, the qubits need to travel in two directions 
and thus the eavesdropper has the advantage to look into 
the qubits twice instead of once as in the case of BB84 [l[ . 
In this paper, we analyze the security of the semiquan- 
tum protocol in the light of symmetric incoherent eaves- 
dropping strategy of [7| that has already been studied 
on BB84 protocol. Since Eve's goal is to decide the se- 
cret key bits established between Alice and Bob, we take 
the success probability of Eve in guessing the key bits 
correctly as a security parameter. 

There could be different attack models and the secu- 
rity analysis in one model may widely differ from that 
in another model. However, to the best of our knowl- 
edge, no quantitative study has been attempted yet in the 
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1. Alice generates N = 8n(l + S) many qubits 
randomly in Z basis or X basis . 

2. For each qubit received at Bob's end, he 
chooses randomly 

• either to reflect it (CTRL) 

• or to measure it in Z basis and resend it 
in the same state he measured (SIFT) . 

3. Alice measures each qubit in the basis she 
sent . 

4. Alice publishes which are the Z bits she 
sent and Bob publishes which ones he chose to 
SIFT". 

5 . Alice checks the error-rate in the CTRL bits 
and aborts the protocol if the error-rate in 
either of the basis is more than some predefined 
threshold value . 

6 . Alice randomly chooses n SIFT bits as TEST 
bits and publishes them. 

7. Bob publishes the values of these TEST bits. 

8. Alice checks the error rate in these bits 
and aborts if the error-rate is more than some 
predefined value. 

9. Alice and Bob select the first n remaining 
SIFT bits to be used as INFO bits. 

10. Alice publishes ECC and PA data and then 
she and Bob use them to extract the final m-bit 
secret key from n-bit INFO string. 



"Thus after this step, the intersection of these two sets, is known to 
both of them and hence it is known to them when Alice transmitted 
the Z-basis and Bob chose to SIFT. There are approximately ^ > 
In such bits from which the secret key will ultimately be chosen. 

TABLE I: Semiquantum Key Distribution with Classical Bob 



II. BACKGROUND 

In this paper, we consider the same symmetric inco- 
herent optimal eavesdropping model of [7| that was used 
for the traditional BB84 protocol It is symmetric, be- 
cause there will be equal error probability at Bob's end 
corresponding to different bases and it is incoherent as 
Eve works with each individual qubit. 

In general, Alice sends a qubit \fj) to Bob and Eve lets 
a four dimensional probe \W) of two qubits (as in 0, 
Section III]) that interacts unitarily with \fx). Eve's mea- 
surement is delayed till Alice announces the basis that 
has been used (i.e., by that time Bob has already mea- 
sured the state). 

We can model it as U(\/j), \W}) = |r), where U is the 
unitary operator and after its application, |t) is the en- 
tangled state of the qubit that Alice sent to Bob and the 
probe applied by Eve. Let D be the disturbance in the 
channel due to the interaction by Eve and F = 1 — D be 
the fidelity. For the |0),|1) basis, i.e., the Z basis, one 
can write the eavesdropping interaction as 

u(\o),\w)) = Vf\e 00 )\o) + Vd\e 01 )\i), 

U(\1),\W}) = VD\E w )\0) + VF\E n )\l). (1) 

Similar equations can be written for the X basis. In 
the traditional BB84 protocol [l| , Alice encodes the bit 
by |0) or |+) and the 1 bit by |1) or |-). After Bob 
completes the measurement and Alice and Bob publish 
relevant information over insecure channel, Eve measures 
the probes she has applied to obtain information about 
the secret bits. Following the analysis in [(| 0], it can 
be shown that with the optimal eavesdropping strategy, 
Eve's average success probability in correctly guessing a 
secret bit is 



context of semiquantum key distribution when non-zero 
disturbance is introduced by the eavesdropper. Hence, 
we investigate this eavesdropping strategy exploiting the 
model of [7|. Our study shows that the two-way appli- 
cation of symmetric incoherent eavesdropping strategy 
helps in obtaining more information in the semiquantum 
protocol [|J than that can be obtained by using one-way 
eavesdropping as applicable on the BB84 [l[ under this 
model. 

In Section|TTl we give a brief review of the attack model 
and the prerequisites for our current work. In Scction HlTl 
we propose a two-way eavesdropping strategy for the 
semiquantum protocol and show that the eavesdropper 
can increase her advantage by combining suitably her ob- 
servations in both the directions of communication. Fi- 
nally, in Section lTVl we propose a better resistance to our 
attack by applying Hadamard gate at Bob's end in the 
semiquantum protocol. 



P < i\D) = - + ^D{l-D). (2) 

Since the advantage of the eavesdropper can be defined 
as the amount by which the success probability exceeds 
the probability of random guessing (which, in this case, 

is |), the advantage is given by (D) = \/ D(l — D). 

Note that the strategy of Q can directly be used 
towards eavesdropping against the semiquantum proto- 
col |ij . Eve will try to interact during the communication 
from Alice to Bob inducing a disturbance D and thus the 
success probability of Eve will be what mentioned in ([2]) 
above. However, we like to explore beyond this trivial 
application of the eavesdropping strategy of Q on BB84 
protocol [l| in semiquantum protocol Towards this, 
we consider that the eavesdropper will try to extract in- 
formation during the transmission of qubits both from 
Alice to Bob and Bob to Alice. This is explained in the 
next section in detail. 
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III. ANALYSIS OF THE SEMIQUANTUM 
PROTOCOL: TWO-WAY EAVESDROPPING 

When Alice sends a qubit to Bob, Eve lets a probe 
\W) that interacts unitarily with \fi). Thus the interac- 
tion can be modelled as U(\ii), \ W)) = |r). If Bob per- 
forms a measurement, then the 3-qubit entangled state 
|r) collapses to a 3-qubit post- measurement product state 
I Tin)- When the corresponding qubit (either reflected or 
measured and resent) returns from Bob to Alice, then 
again Eve tries to interact with a probe \W) and the 
unitary operation can be written as U'(\t"), \W')) = \t'), 
where |r") is |r) or |r m ), according as Bob reflects or 
measures (respectively), and |t') is a 5-qubit state. Eve's 
measurement is delayed till Alice and Bob announce the 
public information and the measurements at Alice's side 
are finished. Measurements at Bob's side get finished 
even earlier during the intermediate stage. Eve will try 
to cleverly use the information obtained from both the 
cases. In particular, if the outcomes of eavesdropping in 
both the directions match, then indeed that is correct 
with a higher probability. 

A. The Binary Symmetric Channel Model 

One may refer to Q to note that the analysis can be 
done considering the model of Binary Symmetric Chan- 
nel (BSC). The main question here is whether more in- 
formation can be extracted at Eve's end by looking into 
both the directions of qubit transmission rather than just 
interacting during one side as in BB84. Eve's advantage 
in obtaining the information in these two cases need to 
be compared against the same disturbance induced in the 
communication channels. Consider the case when both 
the channels are analyzed, one while qubits move from 
Alice to Bob and another during the movement from Bob 
to Alice. Now there are two scenarios. 

• Qubits that Bob measures and then prepares and 
resends (SIFT bits). 

• Qubits that are reflected (CTRL bits). 

For both the scenarios, we have two consecutive Binary 
Symmetric Channels (BSCs) with error probability p in 
each one due to eavesdropping. (There can be eaves- 
dropping inducing different error probabilities p\,P2 m 
the two channels, and that can be taken care of in a sim- 
ilar manner.) Following Equation!]] we can write for the 
channel between Alice and Bob 

U(\0),\W)) = v/l - Pl^oo)|0) + VpI^oi)|1), 
U(\1),\W)) = VPlEioM + VT^lE^l), (3) 

where W is the initial state of the pair of qubits at Eve's 
hand. 

Lemma 1 For the SIFT bits, the round trip channel 
from Alice to Bob and back to Alice is equivalent to a 
binary symmetric channel with error probability 2p(l—p). 



Proof : Since Bob is performing measurement after 
Eve's interaction represented by Equation <j3j> , the com- 
munication from Alice to Bob and that from Bob to Alice 
happen through two separate binary symmetric channels 
with the same error probability p cascaded to each other, 
as shown in Figure Q] The first BSC corresponds to the 
transmission from Alice to Bob and the second one cor- 
responds to the transmission from Bob to Alice. 
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FIG. 1: Cascaded BSC model for the SIFT bits 

Consider one round-trip communication from Alice to 
Bob and then back to Alice. If Alice sends 0, the error- 
path is either 0^0-> 1 or 0—^1—^1. The path is sym- 
metric when Alice sends 1. Thus, the error-probability 
would be given by 

P(no error: Alice — > Bob) • P(error: Bob — > Alice) 
+P(error: Alice — s- Bob) • P(no error: Bob — > Alice) 
= (l-p)p + p(l-p) = 2p(l-p). 

■ 

Lemma 2 For the CTRL bits, the round trip channel 
from Alice to Bob to Alice is equivalent to a binary sym- 
metric channel with error probability 2p(l — p). 

Proof : Without loss of generality, let us consider when 
Alice sends 0. The case when Alice sends 1 would be 
symmetric. 

According to Equation <j3j) , Bob will receive a qubit 
entangled with the two bits of Eve, having the three- 
qubit entangled state yT — p\E oo )\0) + ^/p\E i)\l). Bob 
will send the entangled qubit received as it is to Alice. 
Let W be the initial state of the new pair of qubits at 
Eves hand with which she will interact unitarily with the 
qubit sent from Bob to Alice. This interaction can be 
written as 

/® [/(v/T - p|£oo)|0) + v/p|£oi)|l>, \W')) 
= ((l-p)\E m )\E' m )+p\E Q1 )\E[S)\Q) 
+^p0^(\E oo )\E' ol ) + \E 01 )\E' 11 ))\1), 

where E'^s, are the new two-qubit probes at Eve's hand 
corresponding to Bob sending bit i and Alice receiving 
bit j. Thus, the probability that Alice measures is 
(1 — p) 2 + p 2 and that she measures 1 is 2p(l — p). ■ 
We need to be explicit about Lemma Q] and Lemma [2] 
as the situation in both these cases are different. In one 
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case (SIFT) the qubit is measured at Bob's end and then 
a newly created qubit is sent, i.e., one qubit moves from 
Alice to Bob and a corresponding different one moves 
from Bob to Alice back. In the other case, the qubit is 
just reflected (CTRL), i.e., it is the same qubit that is 
travelling in both the directions (Alice to Bob and Bob 
to Alice). It is important to note that the error in the 
channel observed by Alice is the same in both the cases 
(CTRL and SIFT). This is the reason, the eavesdropping 
model of Q remains symmetric even when it is applied 
to the semiquantum protocol in both the directions. 

Combining Lemma [T] and Lemma ® we can write the 
following Theorem. 

Theorem 1 The round trip channels from Alice to Bob 
to Alice when Bob measures and sends a fresh qubit 
(SIFT) and when he just reflects the received qubit 
(CTRL) are equivalent, and both act as a binary sym- 
metric channel with error probability 2p(l — p). 

Let D one-way and Dtwo-way De the disturbances in 
the one-way BB84 protocol and the two-way semiquan- 
tum protocol respectively. We take D 



we have shown that D 



one-way 



D and 



two-way 



2p(l-p). Both the at- 



tacks should be compared in the same footing, i.e., Eve's 
advantages have to be compared at the same disturbance 
values. For this reason, we take B>two-way = Done-way, 
i.e., D = 2p{l-p). 

In the last section, we have noted that for optimal 
eavesdropping 0] in BB84 protocol, the probability of 

correct guess by Eve can be expressed as Pjp(D) — 
h + \JD(1 — D). That is, inducing a disturbance D £ 
[0,0.5] in the channel (that can be observed at Bob's 
end), Eve can guess the secret bit with a probability 

\ + y/D{\-D). 

We now use the same strategy as in [7| where Eve will 
interact with the qubit transmitted from Alice to Bob 
and the corresponding qubit from Bob to Alice. The dis- 
turbance induced in each of those cases will be p (the 
error probability of BSC) and the value of p will be such 
that D = 2p(l — p). That is, in the semiquantum proto- 
col, when Alice measures the qubits finally returned to 
her, she will experience the error probability D. We de- 

( 2) 

note the probability of correct guess by Eve by P E (D) 
and present the detailed analysis below. 



B. Detailed Analysis of Two-way Eavesdropping 

Eve will have two guesses for the forward and backward 
communication. In each guess, following ([2]) (see also 0), 
Eve has the success probability pe = \ + -\/p(l — p) = 
\ + e, where e = y/p(l — p). If both the guesses give the 
same outcome, then the probability that the bit guessed 
is correct increases. Suppose during the forward commu- 
nication from Alice to Bob, Eve has a success probability 
of | + ei and during the backward communication from 
Bob to Alice, Eve has a success probability of \ + (.2- 



For a particular bit, let pj^- match ^]j^ -foe Eve's posterior 
probability that the bit sent was b, when both her for- 
ward and the backward guesses give the same outcome 
b £ {0, 1}. The following result is easy to show. 
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Proposition 1 P ^ match ) = ^ , . 
The above expression is a simplified form of 

(i+ e i)(i+e 2 ) + (i- £1 )(i- e2 )- iN ° tCtnat 2+1+4^7 ^ 2+ £ l> 

if and only if ei < |. Similar conclusion holds for e 2 
as well. This implies that Eve's success probability 
increases, when she observes the same outcome b in both 
directions and guesses that indeed b was sent. 

Let us now substitute ei = £2 = \/p(l— p), where 
2p(l — p) = D. When Eve observes the same outcome 
in both the directions, let her success probability as a 



function of the disturbance be denoted by P E ' 
Thus, we have the following result. 



(2,inatch) 



(D). 



Lemma 3 P 



(2 , match) 



E 



(D) = -2 



J+D~ 



The corresponding advantage is given 



> ^JD{\ - D) for 



One may easily check that 

D G [0, and in this case, Eve's advantage for the semi- 
quantum protocol is better than what is achieved in the 
eavesdropping Q in BB84 protocol. 

When both the cases do not have the same outcome, 
then the situation is not encouraging. In this case one 
has to consider one of the two outcomes as the correct 
guess. Without loss of generality, we accept the outcome 
of the first observation as the correct guess. In this case, 



P. 



(2 , mismatch) 



E 



{D) = \ + ^{l^p)= l - + ^Dj2. (4) 



It is immediate to note that y/D/2 < J D(l — D) for 
D G [0, i] and in this case Eve suffers with the decreased 
advantage. 

Thus while calculating the average advantage, we con- 
sider the following strategy: "if the outcomes observed 
by Eve in both the directions are the same bit b, she 
guesses 6, else she discards her guess in the backward di- 
rection and considers only the guess during the forward 
direction." Let P^ av9) (D) denote Eve's average success 
probability when she follows the above strategy. 



Theorem 2 P 



(2,avg) 



{D) = \ 



E \^ ) 2 ' 2(1+2L>) 

Proof : It is clear that both the match and the mismatch 
happens with probability ^. Hence the average success 
probability of Eve is given by 



P 



avg) ^jy^ ^- p(2, match) ^j-y-^ ^ -L p(2 7 mismatch) ^j^^ 



1 



Substituting values of the probabilities from Lemma [3] 
and Equation (U|), we get the result. ■ 
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FIG. 2: Advantage of the eavesdropper as a function of disturbance D under different attack models (magnified portion for 
< D < 0.09 is shown on the right). 



The average advantage is given by 



,{2,avg) 



(D) = 



y/D/2(3 + 2D) 
2(1 + 2D) 



In Figure [2j we plot the advantages for different attack 
strategies versus D. Note that p£' av9 \D) > p£\d), 
i.e., Eve has more advantage in the scmiquantum proto- 
col, if D < 0.0877 (upto the fourth decimal place). This 
region is shown magnified in the right portion of Fig. [2] 
for a clearer pictorial exposition. 

The summarized strategy of eavesdropping on the 
scmiquantum protocol is shown in Table [XXJ 

This provides more information to the eavesdropper in 
certain range in the semiquantum protocol [3] than in 
BB84 [l[ and thus our two-way eavesdropping on the the 
scmiquantum protocol recovers more information than 
what can be obtained using the idea of Q directly as it 
was applied against BB84. 

For the semiquantum protocol, Eve does not care to 
have any information about the CTRL bits as those bits 
are not used in generating the final secret key. A priori, 
Eve does not have any information which arc CTRL and 
which arc SIFT bits and thus she needs to probe all the 
bits, with the constraint that the error introduced in the 
channel should be the same in both the cases. This is 
guaranteed following Lemma[TJ Lcmma[2]and TheoremQ] 

The incoherent eavesdropping model of Q can be ap- 
plied for the SIFT bits immediately due to the reason 
that those bits are measured and then freshly prepared 
at Bob's end. Thus the eavesdropping by two unitary 
interactions in the two different channels (Alice to Bob 



1. For D > 0.0877, apply unitary interaction 
for eavesdropping only during the communication 
between Alice and Bob (same as BB84) . 

2. For D < 0.0877, apply unitary interaction 
during both the communications (Alice to Bob and 
Bob to Alice) with disturbance in each channel 
p, where D — 2p(l — p) . 

(a) If the bits obtained through the two 
different interactions are same, then 
accept that as the guessed bit . 

(b) If the bits obtained through the two 
different interactions are different, 
then accept the bit obtained during the 
communication from Alice to Bob as the 
guessed one . 



TABLE II: Eavesdropping strategy on the semiquantum pro- 
tocol of 41 with classical Bob. 



and Bob to Alice) are on two different (but correspond- 
ing) qubits that represent the same bit information in 
the semiquantum protocol. We consider the advantage of 
our two-way idea comparing to the eavesdropping strat- 
egy of that had been applied as it was done against 
BB84. In our case, when the observation from the two 
interactions are same, the success probability of guess- 
ing that bit improves significantly for any D S [0, 0.5] . 
When it is not, the success probability decreases for any 
D e [0, 0.5], but on an average case it is better for certain 
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range of D as described above. 

IV. USING HADAMARD GATE AT BOB'S END 

In Table IIII( we present our new algorithm with 
Hadamard Bob. The main motivation here is to add fur- 
ther security for the SIFT bits (as explained in Step 7) 
which will actually be used to prepare the secret key. The 
random application of Hadamard gate on these bits will 
not allow Eve to guess those bits during the communi- 
cation from Bob to Alice. We emphasize that Alice only 



"She measures either in Z basis, when Bob has not applied the 
Hadamard gate or in X basis, when Bob has applied the Hadamard 
gate. 

TABLE III: Semiquantum Key Distribution with Hadamard 
Bob. The * marked steps are the same as in the semiquantum 
protocol of with Classical Bob. 

measures some portion of the SIFT bits (TEST bits) for 
checking the error in the channel. However, she does not 



need to measure the rest of the SIFT bits where from the 
INFO bits are chosen, because she herself had generated 
these bits. Our Hadamard Bob exploits this feature of 
the semiquantum protocol to confuse Eve. All these bits 
come in {|0), |1)} to Bob from Alice and consider that 
Eve interferes during this stage. However, at the time of 
resending (as explained in Step 2(h) of Table HTI|) . these 
are randomly transferred to {|+), | — )} basis in half of the 
cases. Eve cannot have any prior or posterior information 
where the Hadamard gate is used during the resend by 
Bob as Bob will never publish that. Thus, if Eve tries to 
guess the basis randomly during the backward commu- 
nication from Bob to Alice, then her success probability 
would be 2 only. In Proposition [IJ substituting £2 = 0, 
we have the success probability as \ + (-i = \ + y/D/2. 
Hence, Eve has some advantage over random guessing 
only during the forward communication and it seems that 
she learns nothing during the backward communication. 

Instead of randomly guessing the basis, she can choose 
to measure in the Z-basis all the time. Then for the 
resend bits, she would have advantage £2 half of the times 
and advantage the rest of the times. So her average 
success probability for the backward phase would be 

where £2 = -\/p(l — p). In this case, during the back- 
ward communication, she learns something, but this in- 
formation is less than that she would have learned for 
the two-way eavesdropping strategy on the semiquantum 
protocol with classical Bob Replacing £ 2 by 4f in 
Proposition [Tl we have 

3 F^- 

p(2,match,H) tjy\ _j_ V ^ 

E [ ' ~ 2 2+ 2D' 

Hence the average success probability of Eve is given by 

j- > (2,avg.H) i 1 p(2, match, H) / . I p(2 ^mismatch) / 

"e \ u ) ~ 2 e ^ ' 2 




This is less than P^' av9 \D). Obviously, the correspond- 
ing advantage 

E V 1 \4 + 4Dj 

is less than A^ av9 ^ . One may refer to Figure [2] for a 
graphical comparison. Thus, given the eavesdropping 
strategy discussed above, our strategy of semiquantum 
key distribution with Hadamard Bob is more secure than 
that with classical Bob as in 

Also it may be checked that p^ av9 ' H ^ (£)) [ s less than 
5 + y/D(l - D) for any D e [0,0.5]. Thus, the attacker 
does not need to go for the two-way eavesdropping in this 



1*. Alice generates TV = 8ra(l + 5) many qubits 
randomly in Z basis or X basis. 

2. For each qubit received at Bob's end, he 
chooses randomly 

(i) either to reflect it (CTRL) 

(ii) or to measure it in Z basis and resend 
it 1 ' in the same state or applying the 
Hadamard gate" based on the outcome of an 
unbiased coin tossing on what he measured 
(SIFT) . 

3. Alice will store the received qubits in 
quantum memory. (No measurement will be done at 
this point . ) 

4*. Alice publishes which are the Z bits she 
sent and Bob publishes which ones he chose to 
SIFT. 

5 . Alice measures the CTRL bits . Then she 
checks the error-rate in the CTRL bits and 
aborts the protocol if the error-rate in either 
of the basis is more than some predefined 
threshold value. (This is the first point when 
Alice measures.) 

6*. Alice randomly chooses n SIFT bits as TEST 
bits and publishes them. 

7. Bob publishes the values of these TEST bits 
and also where he has used Hadamard gate. 

8. Alice then measures these qubits in 
corresponding basis and then checks the error 
rate in these bits and aborts if the error-rate 
is more than some predefined value. (This is 
the second point when Alice measures)" . 

9*. Alice and Bob select the first n remaining 
SIFT bits to be used as INFO bits. 

10* . Alice publishes ECC and PA data and then 
she and Bob use them to extract the final m-bit 
secret key from n-bit INFO string. 
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case inducing error probability p such that D = 2p(l —p). 
Instead, eavesdropping in the channel from Alice to Bob 
inducing error probability D will provide better success 
probability for Eve which is the same attack as described 
in Q. Thus, in this respect, one can say that against our 
semiquantum key distribution strategy with Hadamard 
Bob, the best attack known so far is the one described 
in [7j and the two-way eavesdropping does not provide 
any additional advantage. 

V. CONCLUSION 

Boyer et al. (PRL 2007, PRA 2009) introduced 
the quantum key distribution protocol with classical 
Bob, where Bob can measure or prepare qubits only in 
{|0), |1)} basis and reflect any other qubits. They showed 
the robustness of the protocol, but left open any analy- 
sis regarding how the amount of information leakage to 
the eavesdropper is related to the disturbance caused by 



her. This is the motivation behind our current work. We 
analyzed an eavesdropping strategy on this scheme and 
explicitly derived eavesdropper's advantage as a function 
of the disturbance. Here our investigation exploits the 
model of [tJ in both the directions of communication (Al- 
ice to Bob and Bob to Alice). Our two-way eavesdrop- 
ping strategy against the semiquantum protocol extracts 
more information on the secret bits than that could be 
obtained by direct one-way application of the strategy 
in that worked on BB84. 

We also proposed a variant of the scheme by Boyer et 
al., where we replace the classical Bob by a Hadamard 
Bob, i.e., for the resend bits, he randomly applies the 
Hadamard gate in half of the cases, and the rest he re- 
sends as it is. We show that this semiquantum key distri- 
bution with Hadamard Bob is more secure than that with 
classical Bob. The two-way eavesdropping that we have 
proposed in case of semiquantum protocol with classical 
Bob [H does not succeed after introducing the Hadamard 
gate. 
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